Lost or stolen device: incident response playbook

First 15 minutes

1. Record what, where, when and what data was on it.
2. Lock and remotely wipe the device if it is managed.
3. Sign the user out of all sessions and reset passwords stored or cached on it.
4. Report theft to the police and keep the reference number.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (2 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach
• AI tool data leak or misuse